| name | automating-ioc-enrichment |
| description | Automates the enrichment of raw indicators of compromise with multi-source threat intelligence context using SOAR platforms, Python pipelines, or TIP playbooks to reduce analyst triage time and standardize enrichment outputs. Use when building automated enrichment workflows integrated with SIEM alerts, email submission pipelines, or bulk IOC processing from threat feeds. Activates for requests involving SOAR enrichment, Cortex XSOAR, Splunk SOAR, TheHive, Python enrichment pipelines, or automated IOC processing.
|
| domain | cybersecurity |
| subdomain | threat-intelligence |
| tags | ["SOAR","enrichment","IOC","Cortex-XSOAR","Splunk-SOAR","VirusTotal","automation","CTI","NIST-CSF"] |
| version | 1.0.0 |
| author | team-cybersecurity |
| license | Apache-2.0 |
| nist_csf | ["ID.RA-01","ID.RA-05","DE.CM-01","DE.AE-02"] |
Automating IOC Enrichment
When to Use
Use this skill when:
- Building a SOAR playbook that automatically enriches SIEM alerts with threat intelligence context before routing to analysts
- Creating a Python pipeline for bulk IOC enrichment from phishing email submissions
- Reducing analyst mean time to triage (MTTT) by pre-populating alert context with VT, Shodan, and MISP data
Do not use this skill for fully automated blocking decisions without human review — enrichment automation should inform decisions, not execute blocks autonomously for high-impact actions.
Detection Gaps & Validation
- Silent API failures: a 429 or timeout that returns empty stats reads downstream as a clean IOC. Failed calls must raise/log and trigger fallback, never default
vt_malicious=0. The retry_on_429 decorator returns None after max retries -- callers must handle that, not treat it as benign.
- Missing caching: re-querying the same IOC burns rate budget (VT free = 4/min) and stalls the pipeline; cache results ~24h keyed by value+type.
- Composite-score blind spots: the weighted formula (VT 60% / AbuseIPDB 40%) over-trusts AV consensus and under-weights shared-infra context -- a CDN IP can score high. Never auto-block on score alone.
- Latency cliff: if enrichment exceeds ~5 min, analysts work unenriched alerts; enforce timeouts and emit partial results.
To validate: run a known-malicious and a known-benign IOC through the pipeline and confirm scores land in the expected High/Medium/Low routing tier; force (or mock) a 429 and confirm the IOC is flagged "enrichment incomplete," not "clean." Track analyst overrides of the composite score weekly as ground truth and re-tune weights; confirm the cache returns identical results for repeat lookups and that rate-limit decorators actually space VT calls to <=4/min.
Prerequisites
- SOAR platform (Cortex XSOAR, Splunk SOAR, Tines, or n8n) or Python 3.9+ environment
- API keys: VirusTotal, AbuseIPDB, Shodan, and at minimum one TIP (MISP or OpenCTI)
- SIEM integration endpoint for alert consumption
- Rate limit budgets documented per API (VT: 4/min free, 500/min enterprise)
Workflow
Step 1: Design Enrichment Pipeline Architecture
Define the enrichment flow for each IOC type:
SIEM Alert → Extract IOCs → Classify Type → Route to enrichment functions
IP Address → AbuseIPDB + Shodan + VirusTotal IP + MISP
Domain → VirusTotal Domain + PassiveTotal + Shodan + MISP
URL → URLScan.io + VirusTotal URL + Google Safe Browse
File Hash → VirusTotal Files + MalwareBazaar + MISP
→ Aggregate results → Calculate confidence score → Update alert → Notify analyst
